| Engineering journal 6.7.3: Using a firewall router This section uses the scenario illustrated in Figure 6-13 to describe the use of ACLs to restrict traffic to and from a firewall router. Having a designated router act as a firewall is good because it clearly identifies the router's purpose as the external gateway and avoids encumbering other routers with this task. In the event that the internal network needs to isolate itself, the firewall router provides the point of isolation so that the rest of the internal network structure is not affected. In the firewall router configuration that follows, subnet 13 of the Class B network is the firewall subnet, and subnet 14 provides the connection to the worldwide Internet via a service provider: interface ethernet 0 ip address B.B.13.1 255.255.255.0 interface serial 0 ip address B.B.14.1 255.255.255.0 router igrp network B.B.0.0 This simple configuration provides no security and allows all traffic from the outside world onto all parts of the network. To provide security on the firewall router, you need to use ACLs and access groups. An ACL defines the actual traffic that will be permitted or denied, and an access group applies an ACL definition to an interface. ACLs can be used to deny connections that are known to be security risks and then permit all other connections, or to permit connections that are considered acceptable and deny all the rest. For firewall implementation, the latter is the more secure method. The best place to define an ACL is on a host, using a text editor. You can create a file that contains the access-list commands and then upload the file onto the router. Before uploading the access control definition, any previous definition of this ACL is removed by using the following command: no access-list 101 The access-list command can now be used to permit any packets returning to machines from already established connections. With the established keyword, a match occurs if the TCP datagram has the acknowledgment (ACK) or reset (RST) bits set: access-list 101 permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 established After the ACL has been loaded onto the router and stored into nonvolatile random-access memory (NVRAM), you assign it to the appropriate interface. In this example, traffic coming from the outside world via serial 0 is filtered before it is placed on subnet 13 (ethernet 0). Therefore, the access-group command, which assigns an ACL to filter incoming connections, must be assigned to ethernet 0 as follows: interface ethernet 0 ip access-group 101 To control outgoing access to the Internet from the network, you define an ACL and apply it to the outgoing packets on serial 0 of the firewall router. To do this, returning packets from hosts using Telnet or FTP must be allowed to access the firewall subnetwork B.B.13.0. If you have several internal networks connected to the firewall router and the router is using output filters, traffic between internal networks will see a reduction in performance created by the ACL filters. If input filters are used only on the interface going from the router to the outside world, internal networks will not see any reduction in performance.